Security and architecture

Last updated 30 October 2026 · for security and procurement reviews

Data flow

• The app is a static web page. Your inventory file is opened with the browser's File API and processed by JavaScript in the tab.
• No request ever carries an inventory, an address, a customer name or a result. Our server (a Cloudflare Worker) serves the page and answers three small endpoints for licensing: checkout configuration, license issue (Paddle transaction ID and checkout email) and a health check, plus an anonymous visit counter (an event name such as "sample opened" and the link's campaign tag; daily totals only, no IP address or file data stored).
• Downloads are created in memory and saved by your browser to your computer. Closing the tab discards everything.

How to verify it yourself

• Open the app, let it load, switch off your network, run your file and download the results: it still works.
• Open the browser's developer tools (Network tab) during a run: there are no requests.
• Read the code: the engine is plain, unminified JavaScript under /core/ (lcri.js applies the rules, outputs.js builds the files) and /assets/app.js.

Engine checksums (release 1.0.0, 30 October 2026)

SHA-256 of the files that read and process your inventory, as published on this site. Compare with certutil -hashfile file SHA256 or shasum -a 256. Licensed teams can ask for this exact build as a ZIP to host on their own network.

• /core/lcri.js: 9a7a8d073399404fe2bd10c3bd9d46e3160ba95b138d2447ca5ca4920bd4bb09
• /core/outputs.js: 2089bd7cbdd668988db0e9e27910efbf44d6d1d0303d6617842cf3aff7541552
• /core/xlsx-read.js: 20bec06f9d312a6b8ade08a493615bf720925a03c813a8d265330a419fb6ae6a
• /core/xlsx-write.js: af9ca2f2085e8136ea6c02460b9dbb91b3e3082dd1eff6d2f92d5b4a90827da9
• /core/csv.js: 909344fa414ff1a60621e55367e8247deeaf3d8d1c85b9c7bd6ed055a9c728e0
• /assets/app.js: 895f1416d5d4467956278bbdd765858b97f6ac2719c204fed58d5a941e7d9085

Rule check

Every time the app opens it classifies the 8 worked examples in EPA's Service Line Inventory Template and shows the result (8/8 today).

Browser hardening

• Content-Security-Policy: scripts only from this site and, when you buy, from cdn.paddle.com; connections only to this site, Paddle and, for links that carry a PWSID, EPA's public data service (data.epa.gov); framing blocked.
• No analytics, advertising or tracking cookies. Your license key is kept in the browser's local storage and verified offline with an Ed25519 signature.

Sub-processors

• Cloudflare: hosting of the static site and license endpoints (no inventory data).
• Paddle.com: merchant of record for payments, invoices, tax and refunds.

Contact

support@atesensoftware.com: questionnaires, vendor forms and quotes, answered within one business day.